Path Traversal Vulnerability in Network-AI Multi-Agent Orchestrator

CVE-2026-58413

What is CVE-2026-58413?

The vulnerability in Network-AI allows an attacker to manipulate the backup restoration process by forging a backup ID. Prior to version 5.12.2, the EnvironmentManager.restore(env, backupId) function only checked for the existence of a backup path without properly validating the content of the backupId. This oversight made it possible for malicious users to exploit path traversal techniques, allowing for the restoration of files from arbitrary directories outside the intended backup structure. The flaw has been addressed in version 5.12.2, where enhanced validations ensure backup IDs do not contain harmful path elements, significantly improving the security posture of the system.

References